Connecting a packaging machine PLC or high-speed camera array directly to a plant IT switch without physical subnet termination, non-volatile local buffering, and deterministic payload filtering causes control-loop jitter, audit-trail gaps during WAN outages, and saturated uplink switches. Expanding the middle layer introduced in A plain map of device, gateway and platform, an industrial edge gateway enforces IEC 62443-3-3 zone isolation across separate network interfaces, coordinates two-tier OPC UA edge buffering (OPC 10000-4 RAM queues backed by SQLite WAL on industrial pSLC flash), and splits a machine vision inspection system into sub-15 ms reject I/O, structured OPC 40100-1 telemetry, and event-triggered defect image archives.

Architectural Layer & Subsystem Southbound OT Interface (Purdue L1/L2) Edge Gateway Processing & Local Storage Northbound IT / IDMZ Interface (Purdue L3.5/L4) Dominant Failure Mode & Prevention Rule
Network segmentation (IEC 62443-3-3) ETH0 (192.168.1.0/24), no default gateway, 1.5 kV magnetic isolation Application-layer protocol termination; kernel net.ipv4.ip_forward = 0, br0 disabled; TPM 2.0 key seal ETH1 (10.40.12.0/24), outbound-only TLS 1.3 (TCP :8883 / :443), zero open inbound ports Flat Layer 2 bridge exposes PLCs to IT broadcast storms: enforce separate NICs with ip_forward = 0
PLC & PackML state acquisition (OPC 30050 v1.01) OPC UA Binary TCP (:4840), PROFINET IO (0x8892), EtherNet/IP CIP (:44818), S7comm (:102), Modbus Normalizes native PLC registers into OPC 30050 (StateCurrent, UnitModeCurrent, MachSpeed, Admin) Eclipse Sparkplug B v3.0 (NBIRTH, DDATA Protobuf) or OPC UA PubSub (IEC 62541-14) Missed sub-second micro-stops: set SamplingInterval <= 50 ms and QueueSize >= 20 per tag
Two-tier store-and-forward (OPC 10000-4 + SQLite WAL) Tier 1: PLC RAM MonitoredItem queue (SamplingInterval = 50 ms, PublishingInterval = 250–500 ms) Tier 2: Persistent SQLite WAL or RocksDB FIFO ring spool on 20k–30k P/E industrial pSLC NVMe/eMMC Dual-lane replay: Lane 1 live (is_historical: false) + Lane 2 throttled FIFO (is_historical: true) PLC RAM overflow or falsified batch timestamps: monitor Overflow bit 0x0080 and index by SourceTimestamp
Machine vision inspection (OPC 40100-1 + EMVA GenICam) ETH2 / DMA (172.16.10.0/24): 10GigE Vision (MTU 9000) or CoaXPress CXP-12 (1.84–14.44 Gbps raw) Edge GPU/NPU (Jetson Orin 40–275 TOPS) < 15 ms inference + 30-frame circular RAM ring buffer Path 1: < 15 ms 24 V PNP reject DO; Path 2: < 50 kbps ResultType; Path 3: 600 kbps NG ± 2 S3 upload Raw video saturates 1 Gbps plant switch & delays reject: strip pixels from OPC UA; upload only NG ± 2 frames
Cabinet power, thermal & EMC (Moxa UC-8200) 2.0 kV optical isolation on RS-232/422/485 and 24 V DI/DO channels near VFDs and servo drives Fanless EN 60715 DIN-rail aluminum chassis (-40 to +70 °C), dual redundant 12–48 VDC (20 ms hold-up) Supervised hardware watchdog timer + digital fault relay + Stratum 2 NTP / IEEE 1588 PTP clock sync Consumer SSD wear-out & 24 VDC VFD brownout resets: batch WAL commits (250–500 ms) on pSLC flash with PLP

How an industrial edge gateway segments OT machine cells from IT networks

Takeaway: An industrial edge gateway enforces IEC 62443-3-3 System Requirements SR 5.1 (Network Segmentation) and SR 5.2 (Zone Boundary Protection) by terminating southbound Purdue Level 1/2 machine protocols on a non-routable network interface (ETH0) and initiating an independent, outbound-only TLS 1.3 session on a northbound interface (ETH1) with kernel packet forwarding disabled (net.ipv4.ip_forward = 0).

In the three-layer cabinet model outlined in A plain map of device, gateway and platform, field controllers, drives, and sensors occupy the device layer (Purdue Level 1/2), while plant historians, Manufacturing Execution Systems (MES), and cloud analytics occupy the platform layer (Purdue Level 3/3.5/4). Placing an unmanaged switch or a dual-homed PC with IP routing enabled between those layers violates IEC 62443-3-3:2013 FR 5 (Restricted Data Flow): SR 5.1 requires network segmentation and SR 5.2 requires zone boundary protection (deny-all, permit-by-exception).

When multiple packaging lines use an identical 192.168.1.0/24 cabinet subnet, bridging br0 or enabling net.ipv4.ip_forward = 1 triggers two immediate failure modes:

  1. Real-time fieldbus jitter and PLC watchdog faults: Enterprise IT multicast traffic, ARP sweeps, and vulnerability scans flood cabinet switch ports. On cyclic real-time protocols such as PROFINET IO/RT (EtherType 0x8892, 1–4 ms cycle) or EtherNet/IP CIP Implicit I/O (UDP :2222), unscheduled IT bursts delay cyclic frames beyond 3 × update_time, tripping a motion or safety fault.
  2. Lateral attack propagation across machine cells: An unsegmented conduit exposes Siemens S7comm (TCP :102), Modbus TCP (TCP :502), EtherNet/IP (TCP :44818), and unauthenticated OPC UA servers (TCP :4840) to enterprise hosts.

Triple-NIC industrial edge gateway architecture enforcing IEC 62443-3-3 zones and conduits between Purdue Level 1/2 PLCs, isolated 10GigE Vision cameras, and Level 3.5 IDMZ.

Multi-NIC port allocation and routing table enforcement (ETH0, ETH1, ETH2)

Production deployments allocate two or three physically independent Network Interface Cards (NICs) on the industrial edge gateway:

Gateway Interface & Conduit Role Purdue Level & IP Subnet Configuration Permitted Protocols, Ports & Directionality Kernel & Hardware Security Controls (IEC 62443-3-3)
ETH0 — Southbound OT Machine Cell Conduit Purdue L1/L2 · Private cabinet subnet (192.168.1.250/24), no default gateway (0.0.0.0/0 omitted) Outbound polling/subscription to PLC IPs: OPC UA Binary TCP (:4840), PROFINET (UDP :34964), EtherNet/IP (TCP :44818), S7comm (:102), Modbus TCP (:502) net.ipv4.ip_forward = 0; nftables drops inbound SYN on ETH0; 1.5 kV magnetic isolation
ETH1 — Northbound IDMZ / MES / Historian Conduit Purdue L3.5 IDMZ / L4 · Routable plant VLAN (10.40.12.84/24) via IDMZ firewall Outbound-initiated TLS 1.3 only: MQTT Sparkplug B v3.0 or OPC UA PubSub (TCP :8883), HTTPS/S3 (TCP :443), NTP/PTP (UDP :123 / :319) Zero open inbound listening sockets on ETH1; X.509 mTLS key sealed in TPM 2.0
ETH2 — Dedicated High-Speed Vision Camera Bus Purdue L1 sensor bus · Point-to-point jumbo-frame subnet (172.16.10.1/24, MTU 9000) or CoaXPress DMA 10GigE Vision (UDP GVCP/GVSP) or CoaXPress CXP-12 (12.5 Gbps/link) from area-scan cameras Physically isolates 1.84 to 14.44 Gbps raw camera pixel bursts from ETH0 PLC motion I/O
COM1 / COM2 & DI/DO — Isolated Serial & Reject I/O Purdue L0/L1 · RS-232/422/485 (9.6–115.2 kbps) and 24 V DC PNP high-speed DI/DO Modbus RTU / checkweigher frames; < 0.1 ms deterministic 24 V reject trigger and PE_Reject_Confirm 2.0 kV optical isolation (IEC 61000-4-4 EFT / IEC 61000-4-5 surge) blocks VFD ground loops

Omitting a default gateway on ETH0 (192.168.1.0/24 dev eth0 scope link) prevents packets on ETH0 from routing out of ETH1, while outbound-only TLS 1.3 on ETH1 requires zero inbound firewall rules into the machine cell.

Southbound protocol normalization into OPC 30050 PackML and OPC 40100-1

As established in How packaging data moves through OPC UA, placing OPC UA on a diagram does not mean every field device runs an OPC UA server. The industrial edge gateway normalizes heterogeneous registers locally before buffering:

  • Machine state normalization (OPC 30050 v1.01 PackML): Maps native PLC registers into UnitModeCurrent, StateCurrent (across the 17 standard states in How to read PackML machine states), MachSpeed, ProdProcessedCount, and ProdDefectiveCount.
  • Northbound transport (Eclipse Sparkplug B v3.0 vs. OPC UA PubSub IEC 62541-14): Over ETH1, the gateway publishes Report-by-Exception (RBE) updates via OPC UA PubSub (OPC 10000-14) or Eclipse Sparkplug B v3.0 (spBv1.0/<group_id>/<message_type>/<edge_node_id>/<device_id>). Encoding metrics in Google Protocol Buffers (Protobuf) and sending metadata (alias, units, types) only once in NBIRTH / DBIRTH cuts northbound packet overhead by 60% to 75% vs. verbose JSON while tracking session state via NDEATH / DDEATH and bdSeq (0–255).

Cabinet hardware ratings: why commercial IT servers fail on packaging lines

Industrial DIN-rail edge gateways—such as the ARM-based Moxa UC-8200 Series or fanless x86 / Edge-AI IPCs (Siemens SIMATIC IPC227E / IPC427E, Advantech UNO-2484G, NVIDIA Jetson Orin Industrial)—address four cabinet hazards:

  1. Fanless wide-temperature thermal design (-40 °C to +70 °C): Sealed (IP20–IP40) extruded aluminum heatsink chassis on a 35 mm EN 60715 DIN-rail prevent carton-dust fan failures across -25 °C to +70 °C (-40 °C to +70 °C on Moxa UC-8200).
  2. Dual redundant 12 to 48 VDC power with brownout ride-through: Terminal-block inputs include 10 to 20 ms hold-up capacitance (IEC 61131-2) and NVMe Power-Loss Protection (PLP) capacitors to survive 24 VDC motor-start dips.
  3. Galvanic isolation and IEC 61000-4 EMC immunity: 1.5 kV magnetic Ethernet isolation and 2.0 kV optical serial isolation withstand IEC 61000-4-2/4/5 surges and 2 to 5 Grms vibration (IEC 60068-2-64).
  4. Hardware root of trust (Discrete TPM 2.0): An onboard TPM 2.0 (ISO/IEC 11889) seals X.509 private keys and LUKS disk keys against physical media removal.

How OPC UA edge buffering and store-and-forward prevent batch data loss

Takeaway: Reliable OPC UA edge buffering requires a coordinated two-tier queue: Tier 1 (OPC 10000-4 MonitoredItem queues in PLC RAM with QueueSize >= ceil(PublishingInterval / SamplingInterval) × K_burst) absorbs sub-second state bursts on the wire, while Tier 2 (SQLite WAL or RocksDB on the edge gateway’s industrial pSLC flash) persists multi-day outages while preserving the original OPC UA SourceTimestamp required by FDA 21 CFR Part 11 and EU GMP Annex 11.

When a plant IT firewall reboots, an MES database undergoes a weekend upgrade, or a WAN link drops, a packaging line cannot stop packing—nor can it lose quality telemetry. In pharmaceutical, medical-device, and food packaging, electronic batch records (blister seal temperatures, checkweigher gram weights, print-and-verify grades, and reject confirmation counts) must comply with FDA 21 CFR Part 11 and CGMP Data Integrity Guidance and EudraLex Volume 4, EU GMP Annex 11 (Computerised Systems). Both standards enforce ALCOA+ (Attributable, Legible, Contemporaneously recorded, Original, Accurate, + Complete, Consistent, Enduring, Available), requiring validated data transfer (Annex 11 Clause 5), protected storage (Clause 7), and tamper-evident time-stamped audit trails (Clause 9).

The SourceTimestamp vs. ServerTimestamp integrity rule (OPC 10000-4)

Per OPC 10000-4 Section 5.12.1 and Section 7.21, every OPC UA DataValue notification carries two UtcTime timestamps alongside its Value and StatusCode:

  • SourceTimestamp (UtcTime): UTC time when the physical value or state transition was sampled by the PLC or sensor (synced via Stratum 2 NTP or IEEE 1588 PTP).
  • ServerTimestamp (UtcTime): UTC time when the OPC UA server queued or published the notification.

Engineering rule for store-and-forward replay: When an industrial edge gateway buffers telemetry during a 12-hour outage (02:00 to 14:00 UTC) and replays those records at 14:05 UTC, the historian must index every record by its original SourceTimestamp (02:00–14:00 UTC)—never by broker arrival time (14:05 UTC). Indexing by arrival time compresses 12 hours of batch history into a 5-minute spike, violates 21 CFR Part 11 (ALCOA+ Contemporaneous), and triggers false live SCADA alarms. In Eclipse Sparkplug B v3.0, the gateway sets is_historical: true while preserving SourceTimestamp so the historian inserts backfilled points at their true process time.

Two-tier OPC UA edge buffering architecture showing Tier 1 PLC MonitoredItem QueueSize parameters, Tier 2 SQLite WAL pSLC NVMe spool sizing, and Dual-Lane Reconnect Drain.

Tier 1: PLC OPC UA Subscription and MonitoredItem queue parameters (OPC 10000-4 §5.13.1 & §7.21)

OPC 10000-4 Section 5.13.1 (Subscription Model) and Section 7.21 (MonitoringParameters) decouple tag sampling from network publishing via a per-tag ring queue in PLC RAM:

OPC 10000-4 Parameter Spec Reference Recommended Packaging Range Engineering Function & Silent Data-Loss Failure Mode
samplingInterval (Duration, ms) OPC 10000-4 §7.21 10 to 50 ms for discrete counts/states; 250 to 1,000 ms for analog temps Rate at which the PLC OPC UA server checks the underlying PLC variable. Per OEE formula: availability, performance and quality, if samplingInterval exceeds the shortest pack sensor pulse gap, transitions are missed before queuing. Verify revisedSamplingInterval.
publishingInterval (Duration, ms) OPC 10000-4 §5.13.1 250 to 1,000 ms (500 ms typical) Cyclic interval at which the Subscription bundles queued notifications into a PublishResponse over ETH0 (TCP :4840), decoupling 50 ms local sampling from 500 ms packet framing.
queueSize (Counter, uint32) OPC 10000-4 §7.21 20 to 100 for state/count tags (>= ceil(T_pub / T_sample) × K_burst) Notifications held in PLC RAM per MonitoredItem between Publish cycles. Critical Failure Mode: Defaulting to queueSize = 1 with 50 ms sampling and 500 ms publishing overwrites 9 out of 10 sub-second transitions (Execute → Held → Execute).
discardOldest & Overflow Bit (0x0080) OPC 10000-4 §5.12.1 & §7.21 TRUE (with StatusCode 0x0080 bit monitoring) When a MonitoredItem queue fills with discardOldest = TRUE (queueSize > 1), the server drops the oldest entry and sets the InfoBits Overflow bit (0x00000080) in StatusCode. Log any 0x0080 assertion as a Collection_Fault.
maxKeepAliveCount & lifetimeCount OPC 10000-4 §5.13.1 KeepAlive = 10 (5 s); Lifetime = 60 (30 s, >= 3 × KeepAlive) maxKeepAliveCount sends a heartbeat when idle; lifetimeCount sets how many cycles elapse without Publish requests before the PLC deletes the Subscription and purges its RAM queues.

From OPC 10000-4 §7.21, the minimum PLC MonitoredItem queue depth (QueueSize_min) for sampling interval T_sample, publishing interval T_pub, and jitter factor K_burst (2.0 to 3.0) is:

QueueSize_min = ceil(T_pub / T_sample) × K_burst

  • Worked Tier 1 parameter calculation: For PackML StateCurrent sampled at T_sample = 50 ms and published at T_pub = 500 ms (10 samples/cycle) with K_burst = 2.5 (1.25 s TCP retry buffer), QueueSize_min = 10 × 2.5 = 25 slots (configure queueSize = 30). Because PLC RAM subscriptions expire after lifetimeCount × publishingInterval (30–60 s), multi-hour outages require Tier 2 non-volatile flash on the edge gateway.

Tier 2: Persistent local disk spool (SQLite WAL / RocksDB) and pSLC flash endurance

Upon receiving a PublishResponse over ETH0, the edge gateway assigns a 64-bit seq_id and commits the batch to its non-volatile Tier 2 Store-and-Forward Spool before acknowledging the PLC:

  1. Embedded SQLite in Write-Ahead Logging (WAL) Mode (PRAGMA journal_mode = WAL; PRAGMA synchronous = NORMAL;): Appends batches sequentially to the -wal file while the northbound publisher concurrently reads and deletes acknowledged rows in FIFO (ORDER BY seq_id ASC LIMIT 1000) order without lock contention.
  2. LSM-Tree Engines (RocksDB, InfluxDB Edge, TimescaleDB): Flush sequential MemTables to immutable SSTables compressed with Zstandard (zstd) or LZ4 (3.0:1 to 4.5:1 compression ratio).

Preventing flash wear-out: Write Amplification (WAF) and pSLC vs. TLC math

Calling fsync() on every 180-Byte sample (500 writes/s) rewrites full 4–16 KB NAND pages, driving the Write Amplification Factor (WAF) to 15–25. Daily host writes (W_host_day), Drive Writes Per Day (DWPD_actual), and lifetime (Y_life, years) for drive capacity C_drive (GB) and endurance N_PE (P/E cycles) follow:

W_host_day = R_ingest_bytes × 86,400

DWPD_actual = (W_host_day × WAF) / C_drive

Y_life = (C_drive × N_PE) / (W_host_day × WAF × 365)

  • Failure case (Single-row fsync on 32 GB consumer TLC microSD, N_PE = 1,000): At R_ingest_bytes = 90 KB/s (W_host_day = 7.776 GB/day), unbatched writes (WAF = 20) cause 155.52 GB/day of NAND wear (DWPD_actual = 4.86). Against 32 TBW, the card fails in 0.56 years (~6.8 months).
  • Production design (250 ms batched SQLite WAL commits on 64 GB industrial pSLC NVMe, N_PE = 30,000): Batching every 250 ms with Zstd (C_ratio = 3.6, WAF = 1.8) lowers physical writes to 3.888 GB/day (DWPD_actual = 0.061). On a 64 GB industrial pSLC drive (1,920 TBW), endurance exceeds 1,353 years.

How to size the local disk spool and northbound replay drain rate

Takeaway: Size the edge gateway’s local disk spool (B_spool) for a worst-case 72-hour weekend IT/MES outage using B_spool = (R_msg × S_payload × T_outage × K_overhead) / C_ratio, and cap northbound reconnection replay (R_drain_max) across two priority lanes so the backlog drains in T_recovery = (R_ingest × T_outage) / (R_drain_max − R_ingest) without blinding live SCADA screens or triggering a broker thundering herd.

Equation 1: Local store-and-forward spool capacity (B_spool)

For an edge gateway ingesting an aggregate rate of R_msg (samples/s) across all southbound subscriptions, the required persistent disk spool capacity (B_spool, in Bytes or GB) for a design outage duration T_outage (seconds) is:

B_spool = (R_msg × S_payload × T_outage × K_overhead) / C_ratio

Where S_payload is the serialized record size (160 to 200 Bytes raw SQLite/JSON; 40 to 65 Bytes binary Sparkplug B Protobuf), T_outage is the maximum disconnection window (259,200 s for a 72-hour weekend MES upgrade), K_overhead is the B-tree/WAL framing reserve (1.25), and C_ratio is the lossless compression ratio (1.0 raw; 3.2 to 4.0 with Zstd or batched Protobuf).

  • Worked calculation — 72-hour weekend MES outage on a blister and cartoning line: An industrial edge gateway monitors 250 tags generating R_msg = 500 samples/s at S_payload = 180 Bytes/sample (R_ingest = 90 KB/s = 324 MB/hour) across T_outage = 72 hours (259,200 s) with K_overhead = 1.25:
    1. Uncompressed 72-hour spool (C_ratio = 1.0): B_spool_raw = 90,000 × 259,200 × 1.25 = 29,160,000,000 Bytes = 29.16 GB (27.16 GiB) storing 129,600,000 records.
    2. Compressed 72-hour spool (C_ratio = 3.6): B_spool_comp = 29.16 GB / 3.6 = 8.10 GB (7.54 GiB).
    3. Hardware sizing rule: Provisioning a 64 GB industrial pSLC NVMe with a dedicated 32 GB ring-buffer partition holds the entire 72-hour compressed backlog at 25.3% partition occupancy (or holds 72 hours of uncompressed rows at 91.1% occupancy).

Equation 2: Northbound catch-up drain time (T_recovery) and dual-lane throttling

When northbound connectivity returns while the packaging line continues running at R_ingest, the gateway must transmit both live telemetry and the buffered backlog over ETH1. If 40 gateways reconnect simultaneously at unthrottled wire speed (100+ Mbps), they cause a Reconnect Thundering Herd that saturates the MQTT broker and historian CPU. Conversely, if the gateway’s maximum northbound publish rate (R_drain_max) is capped at or below R_ingest, the backlog never clears.

For any throttled cap R_drain_max > R_ingest (with net backlog drain velocity R_net_drain = R_drain_max − R_ingest and over-provisioning ratio M_drain = R_drain_max / R_ingest), the recovery time (T_recovery) to empty an outage of duration T_outage is:

T_recovery = (R_ingest × T_outage) / (R_drain_max − R_ingest) = T_outage / (M_drain − 1)

Outage Duration (T_outage) Buffered Samples (@ 500 samples/s) Buffered Raw / Compressed Size T_recovery at 2:1 Cap (R_drain_max = 1,000/s) T_recovery at 5:1 Cap (R_drain_max = 2,500/s) T_recovery at 10:1 Cap (R_drain_max = 5,000/s)
1 hour (3,600 s) 1,800,000 samples 0.41 GB raw / 0.11 GB comp 1.00 hour (60.0 min) 0.25 hours (15.0 min) 0.11 hours (6.7 min)
8 hours (1 shift) 14,400,000 samples 3.24 GB raw / 0.90 GB comp 8.00 hours (480 min) 2.00 hours (120 min) 0.89 hours (53.3 min)
24 hours (1 day) 43,200,000 samples 9.72 GB raw / 2.70 GB comp 24.0 hours (1,440 min) 6.00 hours (360 min) 2.67 hours (160 min)
72 hours (weekend) 129,600,000 samples 29.16 GB raw / 8.10 GB comp 72.0 hours (3.0 days) 18.0 hours (1,080 min) 8.00 hours (480 min)

Dual-Lane Priority Replay (is_historical: false vs. is_historical: true)

After a 24-hour outage with a 5:1 drain cap (R_drain_max = 2,500 samples/s, net drain 2,000 samples/s), recovery takes T_recovery = (500 × 86,400) / 2,000 = 21,600 s = 6.0 hours. If the gateway uses a single unprioritized FIFO queue, live PackML StateCurrent transitions and active fault alarms sit behind 43.2 million historical samples—blinding SCADA screens for 6.0 hours after the network is repaired. Production edge gateways therefore split ETH1 publishing into two priority lanes:

  1. Lane 1 — Real-Time State & Alarm Bypass (is_historical: false, Priority 1): Publishes live incoming samples (R_ingest = 500 samples/s) immediately upon NBIRTH / DBIRTH session establishment so SCADA dashboards display current machine states within < 250 ms.
  2. Lane 2 — Throttled Historical FIFO Backfill (is_historical: true, Priority 2): Drains the SQLite WAL spool in chronological FIFO order (ORDER BY seq_id ASC) using the remaining bandwidth budget (R_drain_max − R_ingest = 2,000 samples/s) with SourceTimestamp preserved and a 5 to 30 s randomized reconnect delay across gateways.

How a machine vision inspection system offloads defects without saturating the plant network

Takeaway: A high-speed packaging machine vision inspection system (600 ppm, four 5 MP cameras = 14.44 Gbps raw stream) cannot stream raw video to the cloud or wait for a network round-trip to fire a reject valve; an edge vision IPC splits the pipeline into Path 1 (< 15 ms local 24 V PNP / EtherCAT reject + verification), Path 2 (< 50 kbps OPC 40100-1 structured telemetry), and Path 3 (600 kbps event-triggered NG ± 2 context frame uploads), reducing northbound bandwidth by 99.97%.

Pharmaceutical blister lines, vial inspection machines, and beverage bottling lines use multi-camera machine vision inspection systems to verify 2D DataMatrix codes (Close the loop from print to reject), inspect heat-seal integrity, and check cap skew. Streaming uncompressed camera feeds across the plant network violates both switch bandwidth limits and real-time reject kinematics.

Raw camera bit-rate equation (B_cam) vs. plant network capacity

For N_cam cameras of resolution W_px × H_px (pixels), bit depth BPP (bits/pixel), and frame rate FPS (frames/s), the uncompressed camera bit rate (B_cam) over EMVA GigE Vision or CoaXPress is:

B_cam = N_cam × W_px × H_px × BPP × FPS

  • Worked bandwidth calculation — 600 ppm 4-camera 5 MP packaging station: Inspecting 600 packs/min (10 packs/s) with N_cam = 4 cameras (2,448 × 2,048 = 5,013,504 px, BPP = 12-bit, FPS = 60 fps multi-strobe capture) generates 3.61 Gbps (451.2 MB/s) per camera and B_cam = 14.44 Gbps (1.805 GB/s, or 6.50 TB/hour) across the four-camera station (and 1.84 Gbps even on a modest 2-camera 2.3 MP Mono8 @ 50 fps station). Routing 1.84 to 14.44 Gbps onto a 1 Gbps plant switch saturates the uplink immediately.

Machine vision inspection system 3-path edge offload architecture separating sub-15 ms hard-real-time reject I/O, sub-50 kbps OPC 40100-1 telemetry, and 600 kbps event-triggered NG image uploads.

Deterministic reject window math (T_vision_loop <= 15 ms) at 600 ppm

At 600 packs/min (10 packs/s) on a 1.5 m/s (1.5 mm/ms) conveyor with 150 mm pack pitch, each pack window is 100 ms. As detailed in Verify the reject, not only the camera, the vision controller must complete acquisition, inference, and shift-register queuing before the pack reaches the reject nozzle:

T_vision_loop = T_exposure + T_readout_DMA + T_preprocess_infer + T_IO_trigger

On an edge vision IPC with an NVIDIA Jetson Orin (40 to 275 TOPS INT8) connected to cameras on ETH2 (10GigE Vision / CoaXPress), LED strobe exposure (T_exposure = 0.1–0.5 ms), DMA readout (T_readout_DMA = 2.0–4.5 ms), INT8 neural inference (T_preprocess_infer = 3.5–7.0 ms), and encoder shift-register I/O (T_IO_trigger = 0.5–1.0 ms) sum to T_vision_loop = 6.1 to 13.0 ms (<= 15 ms deterministic upper bound).

The 3-Path Edge Vision Split Architecture (OPC 40100-1 + Async S3)

Offload Path & Destination Protocol & Physical Interface Payload Content & Companion Standard Average Bandwidth & Outage Behavior
Path 1 — Hard-Real-Time Reject & Confirmation Loop (Southbound OT) 24 V DC PNP opto-isolated DO (<= 0.1 ms jitter) to PLC encoder shift register, or EtherCAT / PROFINET IRT (1–4 ms) Pass_Bit, Reject_Cmd_Bit, Encoder_Tick_ID, plus closed-loop read of PE_Reject_Confirm (100–250 ms downstream per vision reject verification) < 10 kbps cyclic I/O · Runs 100% autonomously inside the machine cabinet even if the plant LAN is offline
Path 2 — Continuous Structured Telemetry & OEE Counts (Northbound ETH1) OPC 40100-1 Machine Vision (ResultManagementType / ResultType) + OPC 30050 PackML via SQLite WAL → Sparkplug B (:8883) resultId, SourceTimestamp, lotId, serialCode, defectClassId (SEAL_CONTAM, OCR_FAIL), confidenceScore, processingTimes, rejectConfirmed, and ISO 22400-2 OEE counts (PQ, GQ). Zero pixel bytes. 15 to 45 kbps (< 0.0004% of raw stream) · 100% buffered in the gateway’s SQLite WAL spool (B_spool) across 72-hour outages
Path 3 — Event-Triggered NG ± 2 Image Ring Buffer (Northbound ETH1 Background) 30-frame circular RAM ring buffer flushed on NG trigger to /var/spool/vision-ng/ NVMe → throttled background HTTPS PUT / S3 (:443) Lossless PNG or high-bitrate WebP (~300 KB) of the failed NG full frame + ROI crop, plus ±2 surrounding pack context frames (2 before, 2 after) and a JSON manifest linked via OPC 40100-1 hasTransferableDataOnFile: true 600 kbps average (4.5 MB/min at 0.5% NG rate on 600 ppm) · 99.97% bandwidth reduction (6.50 TB/h → 0.27 GB/h); token-bucket capped at <= 5 Mbps
  • Worked NG ± 2 context window math: Capturing the 2 packs before (N−2, N−1) and 2 packs after (N+1, N+2) each failed pack (5 frames × 300 KB = 1.50 MB/event) diagnoses whether a defect was an isolated particle or a progressive film-splice/nozzle drift. At 600 ppm with a 0.5% reject rate (3 NG events/min), Path 3 uploads 3 × 1.50 MB = 4.50 MB/min = 75 KB/s = 600 kbps (270 MB/hour), cutting northbound traffic from 14.44 Gbps (6.50 TB/h) to 640 kbps combined (Path 2 + Path 3).

Where the edge gateway boundary stops

Takeaway: Keep the industrial edge gateway telemetry, buffering, and asynchronous image offload plane strictly separated from hardwired ISO 13849-1 / IEC 62061 functional safety circuits and closed-loop PLC reject verification interlocks.

An industrial edge gateway provides protocol normalization, IEC 62443-3-3 network segmentation, OPC UA store-and-forward resilience, and quality archive management; it is not a safety PLC and must never sit in the execution path of a time-critical mechanical interlock:

  1. Functional safety (ISO 13849-1 PL d / PL e and IEC 62061 SIL 2 / SIL 3): Light curtains, safety laser scanners (such as those governing AMR vs AGV at a packaging line: VDA 5050 fleet control and pallet handoffs), guard-door switches, and E-Stop circuits must be wired directly to a certified safety controller (PROFIsafe, CIP Safety, FSoE, or dual-channel safety relays). The edge gateway may subscribe to diagnostic safety state tags read-only over ETH0 to log safety stops in the OEE data collection ledger, but must never issue safety reset or guard-unlock commands.
  2. Closed-loop physical reject verification (PE_Reject_Confirm): As established in Verify the reject, not only the camera, logging an NG vision result in OPC 40100-1 or Sparkplug B does not prove the defective pack entered the locked reject bin. The encoder shift register, solenoid firing window, and downstream reject confirmation photo-eye (PE_Reject_Confirm) must remain hard-interlocked inside the Level 1 PLC so a drop in air pressure or jammed diverter halts the packaging machine (PackML Held / Suspended) within milliseconds—even if the edge gateway or plant network is offline.

Return to the parent architecture overview at A plain map of device, gateway and platform, review the companion information model in How packaging data moves through OPC UA, or browse all technical reference guides in Industrial Connectivity.